Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2024 02:10

General

  • Target

    2cb40d63d23cb6e223f8b6bc7562e3e24f3681110670ff7e27eb82f22031e616.dll

  • Size

    1.3MB

  • MD5

    78cd435c2bb78c951eb88ade80c5c5fe

  • SHA1

    c3c5629d2b6dad9a6e91b917829b3815ec8eaa7a

  • SHA256

    2cb40d63d23cb6e223f8b6bc7562e3e24f3681110670ff7e27eb82f22031e616

  • SHA512

    ac4221b69e7ffa70660d891af300cfeba463c1cd3f3581529f9b6c94c88d9e547a7df2f2c21e499a3034044d76452da42f7bbc041c9787629f75f7c8b1a97689

  • SSDEEP

    12288:JXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:FB/Qn0rbD8UZUDtgIiemI51Mwtewkm

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 12 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cb40d63d23cb6e223f8b6bc7562e3e24f3681110670ff7e27eb82f22031e616.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2380
  • C:\Windows\system32\lpksetup.exe
    C:\Windows\system32\lpksetup.exe
    1⤵
      PID:2832
    • C:\Users\Admin\AppData\Local\2Ntdy\lpksetup.exe
      C:\Users\Admin\AppData\Local\2Ntdy\lpksetup.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2884
    • C:\Windows\system32\mstsc.exe
      C:\Windows\system32\mstsc.exe
      1⤵
        PID:264
      • C:\Users\Admin\AppData\Local\oFkZ3KyV\mstsc.exe
        C:\Users\Admin\AppData\Local\oFkZ3KyV\mstsc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1136
      • C:\Windows\system32\FXSCOVER.exe
        C:\Windows\system32\FXSCOVER.exe
        1⤵
          PID:940
        • C:\Users\Admin\AppData\Local\Ndg9znpaL\FXSCOVER.exe
          C:\Users\Admin\AppData\Local\Ndg9znpaL\FXSCOVER.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:836

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\2Ntdy\dpx.dll

          Filesize

          1.3MB

          MD5

          1c16d07184d7e3bb22a76f0f38ee96c1

          SHA1

          df70b01870bd776118cd0b20c068aaba932702d7

          SHA256

          05d04c9ea336912d2bd709d24127d6d968b87ad427fa887126ff3794ade134bd

          SHA512

          9edc0f58619b6159f1fd7fcd1fb0be061ad7c8bbd5fddc37ce008288226f4dfd3c8a5b3ef1f1783485b7b9967cf86886b25f358e2298e0178d59d799aa924ec1

        • C:\Users\Admin\AppData\Local\2Ntdy\lpksetup.exe

          Filesize

          638KB

          MD5

          50d28f3f8b7c17056520c80a29efe17c

          SHA1

          1b1e62be0a0bdc9aec2e91842c35381297d8f01e

          SHA256

          71613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f

          SHA512

          92bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861

        • C:\Users\Admin\AppData\Local\Ndg9znpaL\MFC42u.dll

          Filesize

          1.3MB

          MD5

          52f0bd4b796e5cb7cb555fc0341c59bd

          SHA1

          3776d52eefe28acb51c7ca7bdca000f01f3add80

          SHA256

          4f48b38a1147ec1af63233d2213a44540eec34276763f728e9be0ac313ccf663

          SHA512

          e7ab5a309f4f6b4655c989b876333173c2149200dc1ec00c6c2c5c58da8fc15906a3e63ff7ef45fc34d864e2a96effdae835c28e938c5b6040260e271250ba0c

        • C:\Users\Admin\AppData\Local\oFkZ3KyV\credui.dll

          Filesize

          1.3MB

          MD5

          561a76f34f2dc7769efe2118d967fc58

          SHA1

          d845f98cd79d1c8b08b52bbbd92c6a640c0108c7

          SHA256

          96ad827c72ed2fcea2958f566d71770e6d6865014b276edb3cf565eb736b17e4

          SHA512

          c1434397a3b1050caaee4836f5ac18ea30f3f121e10a4704f37982f18007353bc87d8e3b9e8cc738ae8cce9c4d3c37def47049098b3d3fe6e8bb874d28b5cc54

        • C:\Users\Admin\AppData\Local\oFkZ3KyV\mstsc.exe

          Filesize

          1.1MB

          MD5

          50f739538ef014b2e7ec59431749d838

          SHA1

          b439762b8efe8cfb977e7374c11a7e4d8ed05eb3

          SHA256

          85c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3

          SHA512

          02e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wkybhziu.lnk

          Filesize

          971B

          MD5

          6fe866815ca7b0f0ba4459fd5c1afad9

          SHA1

          a20e03d8474db8536c75f47ddefc1c0f7332d1ad

          SHA256

          3e3f87d90249c49a9a7c787dfcece3a90995f14de034e09f483106c1df864460

          SHA512

          a98d886fcd9978635fb2fda1a4c2b5bed277b3f52fff21c072da07e47d23c30560cec1be43e9e901bd648f6f528c40f50d9dfb539fba4738f0a55692fff6999e

        • \Users\Admin\AppData\Local\Ndg9znpaL\FXSCOVER.exe

          Filesize

          261KB

          MD5

          5e2c61be8e093dbfe7fc37585be42869

          SHA1

          ed46cda4ece3ef187b0cf29ca843a6c6735af6c0

          SHA256

          3d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121

          SHA512

          90bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b

        • memory/836-138-0x000007FEF7EC0000-0x000007FEF8011000-memory.dmp

          Filesize

          1.3MB

        • memory/836-134-0x000007FEF7EC0000-0x000007FEF8011000-memory.dmp

          Filesize

          1.3MB

        • memory/1136-98-0x000007FEF7ED0000-0x000007FEF801B000-memory.dmp

          Filesize

          1.3MB

        • memory/1136-94-0x0000000000190000-0x0000000000197000-memory.dmp

          Filesize

          28KB

        • memory/1136-95-0x000007FEF7ED0000-0x000007FEF801B000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-11-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-31-0x0000000077DC0000-0x0000000077DC2000-memory.dmp

          Filesize

          8KB

        • memory/1344-17-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-15-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-40-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-41-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-14-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-12-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-3-0x0000000077B26000-0x0000000077B27000-memory.dmp

          Filesize

          4KB

        • memory/1344-9-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-7-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-6-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-16-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-13-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-4-0x0000000002A70000-0x0000000002A71000-memory.dmp

          Filesize

          4KB

        • memory/1344-50-0x0000000077B26000-0x0000000077B27000-memory.dmp

          Filesize

          4KB

        • memory/1344-20-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-8-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-10-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-29-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-18-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-30-0x0000000077D90000-0x0000000077D92000-memory.dmp

          Filesize

          8KB

        • memory/1344-19-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/1344-28-0x0000000002A50000-0x0000000002A57000-memory.dmp

          Filesize

          28KB

        • memory/1344-22-0x0000000140000000-0x000000014014A000-memory.dmp

          Filesize

          1.3MB

        • memory/2380-49-0x000007FEF8000000-0x000007FEF814A000-memory.dmp

          Filesize

          1.3MB

        • memory/2380-1-0x000007FEF8000000-0x000007FEF814A000-memory.dmp

          Filesize

          1.3MB

        • memory/2380-0-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/2884-62-0x000007FEF8000000-0x000007FEF814B000-memory.dmp

          Filesize

          1.3MB

        • memory/2884-60-0x000007FEF8000000-0x000007FEF814B000-memory.dmp

          Filesize

          1.3MB

        • memory/2884-58-0x0000000000310000-0x0000000000317000-memory.dmp

          Filesize

          28KB